nixos/acme: use types.secretFile for credential files

NixOS · Jun 6, 2022 · b4df6da · b4df6da
1 parent 67e17c7
commit b4df6da
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/nixos/modules/security/acme/default.nix b/nixos/modules/security/acme/default.nix
@@ -554,7 +554,7 @@ let
       };
 
       credentialsFile = mkOption {
-        type = types.path;
+        type = types.secretFile;
         inherit (defaultAndText "credentialsFile" null) default defaultText;
         description = ''
           Path to an EnvironmentFile for the cert's service containing any required and

diff --git a/nixos/tests/acme.nix b/nixos/tests/acme.nix
@@ -18,12 +18,12 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: let
   dnsConfig = nodes: {
     dnsProvider = "exec";
     dnsPropagationCheck = false;
-    credentialsFile = pkgs.writeText "wildcard.env" ''
+    credentialsFile = lib.types.secretFile.makeWorldReadable (pkgs.writeText "wildcard.env" ''
       EXEC_PATH=${dnsScript nodes}
       EXEC_POLLING_INTERVAL=1
       EXEC_PROPAGATION_TIMEOUT=1
       EXEC_SEQUENCE_INTERVAL=1
-    '';
+    '');
   };
 
   documentRoot = pkgs.runCommand "docroot" {} ''